Back to Checks
gcp

VM instance has deletion protection enabled

compute_instance_deletion_protection_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/Instance

This check verifies whether GCP Compute Engine VM instances have deletion protection enabled to prevent accidental termination of production or critical workloads.

Prowler logoProwlerprowler-provider-gcp

Risk

Without deletion protection enabled, VM instances are vulnerable to accidental deletion by users with sufficient permissions.

This could result in:

  • Service disruption and downtime for critical applications
  • Data loss if persistent disks are also deleted
  • Recovery delays while recreating instances and restoring configurations

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_deletion_protection_enabled

Recommendation

Enable deletion protection on all production and business-critical VM instances to prevent accidental termination. Regularly review instances to ensure critical workloads are protected.

Remediation

CLI

gcloud compute instances update INSTANCE_NAME --deletion-protection --zone=ZONE

Terraform

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  # Enable deletion protection
  deletion_protection = true

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"
  }
}

Other

1Open the Google Cloud Console
2Navigate to Compute Engine > VM instances
3Select the target VM instance
4Click Edit
5Under Deletion protection, check the box to enable
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_deletion_protection_enabled(Check):
    """
    Ensure that VM instance has deletion protection enabled.

    This check verifies whether GCP Compute Engine VM instances have deletion protection
    enabled to prevent accidental termination of production or critical workloads.

    - PASS: VM instance has deletion protection enabled.
    - FAIL: VM instance does not have deletion protection enabled.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"VM Instance {instance.name} has deletion protection enabled."
            )
            if not instance.deletion_protection:
                report.status = "FAIL"
                report.status_extended = f"VM Instance {instance.name} does not have deletion protection enabled."
            findings.append(report)

        return findings

References